PatchClock

PHP security digest · Packages

drupal/commerce security advisories

6 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Not rated 28 Oct 2026

    This module enables you to sell goods and services to customers through a shopping cart and checkout form. The module doesn't sufficiently restrict the product...

    Fixed in 2.41.0, 3.3.13 · CVE-2026-118544

  2. Not rated 28 Oct 2026

    This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with anno...

    Fixed in 2.41.0, 3.3.13 · CVE-2026-118543

  3. Not rated 28 Oct 2026

    This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites can also create multiple online stores that are...

    Fixed in 2.41.0, 3.3.13 · CVE-2026-118542

  4. Not rated 28 Oct 2026

    This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the co...

    Fixed in 2.41.0, 3.3.13 · CVE-2026-118541

  5. Not rated 28 Oct 2026

    This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API modul...

    Fixed in 2.41.0, 3.2.0 · CVE-2026-118540

  6. Not rated 28 Oct 2026

    This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs....

    Fixed in 2.41.0, 3.3.13 · CVE-2026-118539

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including drupal/commerce, and the version that fixes it.